You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2018/09/12 13:26:34 UTC
[cxf] branch master updated (d873c8b -> 3d50120)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from d873c8b CXF-7839 - Switch Claim claimType from URI to String.
new 384a11f CXF-6727 - Parse Claims annotation in a manner independent of the token
new bbe640d CXF-6727 - Move Claims functionality into the rt-security module
new 3d50120 Updating JAX-RS API
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
parent/pom.xml | 2 +-
.../authorization/ClaimsAuthorizingFilter.java | 4 +-
.../authorization/SecurityContextProviderImpl.java | 2 +-
.../cxf/rt/security/saml/utils/SAMLUtils.java | 2 +-
.../rt/security/saml/claims/SAMLClaimsTest.java | 1 +
.../apache/cxf/rt/security}/claims/ClaimBean.java | 23 ++---
.../apache/cxf/rt/security}/claims/SAMLClaim.java | 5 +-
.../interceptor/ClaimsAuthorizingInterceptor.java | 32 ++++---
.../ClaimsAuthorizingInterceptorTest.java | 97 ++++++++++++++++++----
.../oauth2/common/SamlCallbackHandler.java | 2 +-
.../jaxrs/security/saml/SamlCallbackHandler.java | 2 +-
11 files changed, 120 insertions(+), 52 deletions(-)
rename rt/{security-saml/src/main/java/org/apache/cxf/rt/security/saml => security/src/main/java/org/apache/cxf/rt/security}/claims/ClaimBean.java (75%)
rename rt/{security-saml/src/main/java/org/apache/cxf/rt/security/saml => security/src/main/java/org/apache/cxf/rt/security}/claims/SAMLClaim.java (97%)
rename rt/{security-saml/src/main/java/org/apache/cxf/rt/security/saml => security/src/main/java/org/apache/cxf/rt/security/claims}/interceptor/ClaimsAuthorizingInterceptor.java (87%)
rename rt/{security-saml/src/test/java/org/apache/cxf/rt/security/saml => security/src/test/java/org/apache/cxf/rt/security/claims}/interceptor/ClaimsAuthorizingInterceptorTest.java (77%)
[cxf] 01/03: CXF-6727 - Parse Claims annotation in a manner
independent of the token
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 384a11f419c06c52ec07d9f7114bb2134c18ba3c
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 12 11:58:47 2018 +0100
CXF-6727 - Parse Claims annotation in a manner independent of the token
---
.../cxf/rt/security/saml/claims/ClaimBean.java | 22 +++++++++++++---------
.../interceptor/ClaimsAuthorizingInterceptor.java | 18 ++++++++----------
.../ClaimsAuthorizingInterceptorTest.java | 2 +-
3 files changed, 22 insertions(+), 20 deletions(-)
diff --git a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java
index f46cb94..3216f7a 100644
--- a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java
+++ b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java
@@ -18,26 +18,30 @@
*/
package org.apache.cxf.rt.security.saml.claims;
+import org.apache.cxf.rt.security.claims.Claim;
import org.apache.cxf.security.claims.authorization.ClaimMode;
public class ClaimBean {
- private SAMLClaim claim;
- private ClaimMode claimMode;
- private boolean matchAll;
+ private final Claim claim;
+ private final String claimFormat;
+ private final ClaimMode claimMode;
+ private final boolean matchAll;
- public ClaimBean(SAMLClaim claim) {
- this.claim = claim;
- }
-
- public ClaimBean(SAMLClaim claim,
+ public ClaimBean(Claim claim,
+ String claimFormat,
ClaimMode claimMode,
boolean matchAll) {
this.claim = claim;
+ this.claimFormat = claimFormat;
this.claimMode = claimMode;
this.matchAll = matchAll;
}
- public SAMLClaim getClaim() {
+ public String getClaimFormat() {
+ return claimFormat;
+ }
+
+ public Claim getClaim() {
return claim;
}
diff --git a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java
index f19471a..c69992a 100644
--- a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java
+++ b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java
@@ -105,12 +105,11 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
org.apache.cxf.rt.security.claims.ClaimCollection actualClaims = sc.getClaims();
for (ClaimBean claimBean : list) {
- org.apache.cxf.rt.security.claims.Claim claim = claimBean.getClaim();
org.apache.cxf.rt.security.claims.Claim matchingClaim = null;
for (org.apache.cxf.rt.security.claims.Claim cl : actualClaims) {
if (cl instanceof SAMLClaim
- && ((SAMLClaim)cl).getName().equals(((SAMLClaim)claim).getName())
- && ((SAMLClaim)cl).getNameFormat().equals(((SAMLClaim)claim).getNameFormat())) {
+ && ((SAMLClaim)cl).getName().equals(claimBean.getClaim().getClaimType())
+ && ((SAMLClaim)cl).getNameFormat().equals(claimBean.getClaimFormat())) {
matchingClaim = cl;
break;
}
@@ -121,7 +120,7 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
}
continue;
}
- List<Object> claimValues = claim.getValues();
+ List<Object> claimValues = claimBean.getClaim().getValues();
List<Object> matchingClaimValues = matchingClaim.getValues();
if (claimBean.isMatchAll()
&& !matchingClaimValues.containsAll(claimValues)) {
@@ -189,8 +188,8 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
private static boolean isClaimOverridden(ClaimBean bean, List<ClaimBean> mClaims) {
for (ClaimBean methodBean : mClaims) {
- if (bean.getClaim().getName().equals(methodBean.getClaim().getName())
- && bean.getClaim().getNameFormat().equals(methodBean.getClaim().getNameFormat())) {
+ if (bean.getClaim().getClaimType().equals(methodBean.getClaim().getClaimType())
+ && bean.getClaimFormat().equals(methodBean.getClaimFormat())) {
return true;
}
}
@@ -208,7 +207,7 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
annClaims.add(claimAnn);
}
for (Claim ann : annClaims) {
- SAMLClaim claim = new SAMLClaim();
+ org.apache.cxf.rt.security.claims.Claim claim = new org.apache.cxf.rt.security.claims.Claim();
String claimName = ann.name();
if (nameAliases.containsKey(claimName)) {
@@ -219,13 +218,12 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
claimFormat = formatAliases.get(claimFormat);
}
- claim.setName(claimName);
- claim.setNameFormat(claimFormat);
+ claim.setClaimType(claimName);
for (String value : ann.value()) {
claim.addValue(value);
}
- claimsList.add(new ClaimBean(claim, ann.mode(), ann.matchAll()));
+ claimsList.add(new ClaimBean(claim, claimFormat, ann.mode(), ann.matchAll()));
}
return claimsList;
}
diff --git a/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java b/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java
index e35bb56..5e6b14b 100644
--- a/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java
+++ b/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java
@@ -189,7 +189,7 @@ public class ClaimsAuthorizingInterceptorTest extends Assert {
claim.addValue("c");
in2.setClaims(Collections.singletonMap("test",
Collections.singletonList(
- new ClaimBean(claim))));
+ new ClaimBean(claim, "a", null, false))));
in2.handleMessage(m);
try {
[cxf] 03/03: Updating JAX-RS API
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 3d50120145c232886f0e9b41e1974c9e69c0fb86
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 12 14:26:20 2018 +0100
Updating JAX-RS API
---
parent/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index 1b13297..f7699df 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -119,7 +119,7 @@
<cxf.geronimo.transaction.version>3.1.4</cxf.geronimo.transaction.version>
<cxf.jasypt.bundle.version>1.9.0_1</cxf.jasypt.bundle.version>
<cxf.javassist.version>3.21.0-GA</cxf.javassist.version>
- <cxf.javax.ws.rs.version>2.1</cxf.javax.ws.rs.version>
+ <cxf.javax.ws.rs.version>2.1.1</cxf.javax.ws.rs.version>
<cxf.jaxb.version>2.2.11</cxf.jaxb.version>
<cxf.jaxb.impl.version>${cxf.jaxb.version}</cxf.jaxb.impl.version>
<cxf.jaxb.core.version>${cxf.jaxb.version}</cxf.jaxb.core.version>
[cxf] 02/03: CXF-6727 - Move Claims functionality into the
rt-security module
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit bbe640de94faba94819074234cf4b6a8b637df75
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 12 13:22:26 2018 +0100
CXF-6727 - Move Claims functionality into the rt-security module
---
.../authorization/ClaimsAuthorizingFilter.java | 4 +-
.../authorization/SecurityContextProviderImpl.java | 2 +-
.../cxf/rt/security/saml/utils/SAMLUtils.java | 2 +-
.../rt/security/saml/claims/SAMLClaimsTest.java | 1 +
.../apache/cxf/rt/security}/claims/ClaimBean.java | 3 +-
.../apache/cxf/rt/security}/claims/SAMLClaim.java | 5 +-
.../interceptor/ClaimsAuthorizingInterceptor.java | 14 ++--
.../ClaimsAuthorizingInterceptorTest.java | 95 +++++++++++++++++++---
.../oauth2/common/SamlCallbackHandler.java | 2 +-
.../jaxrs/security/saml/SamlCallbackHandler.java | 2 +-
10 files changed, 98 insertions(+), 32 deletions(-)
diff --git a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/ClaimsAuthorizingFilter.java b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/ClaimsAuthorizingFilter.java
index 7997d40..45112e4 100644
--- a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/ClaimsAuthorizingFilter.java
+++ b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/ClaimsAuthorizingFilter.java
@@ -28,8 +28,8 @@ import javax.ws.rs.core.Response;
import org.apache.cxf.interceptor.security.AccessDeniedException;
import org.apache.cxf.jaxrs.utils.JAXRSUtils;
import org.apache.cxf.message.Message;
-import org.apache.cxf.rt.security.saml.claims.ClaimBean;
-import org.apache.cxf.rt.security.saml.interceptor.ClaimsAuthorizingInterceptor;
+import org.apache.cxf.rt.security.claims.ClaimBean;
+import org.apache.cxf.rt.security.claims.interceptor.ClaimsAuthorizingInterceptor;
public class ClaimsAuthorizingFilter implements ContainerRequestFilter {
diff --git a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/SecurityContextProviderImpl.java b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/SecurityContextProviderImpl.java
index 0f5c7e8..8e8158c 100644
--- a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/SecurityContextProviderImpl.java
+++ b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/SecurityContextProviderImpl.java
@@ -27,7 +27,7 @@ import org.apache.cxf.message.Message;
import org.apache.cxf.rs.security.saml.assertion.Subject;
import org.apache.cxf.rt.security.SecurityConstants;
import org.apache.cxf.rt.security.claims.ClaimCollection;
-import org.apache.cxf.rt.security.saml.claims.SAMLClaim;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.cxf.rt.security.saml.claims.SAMLSecurityContext;
import org.apache.cxf.rt.security.saml.utils.SAMLUtils;
import org.apache.cxf.rt.security.utils.SecurityUtils;
diff --git a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
index b30604a..692d075 100644
--- a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
+++ b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
@@ -32,7 +32,7 @@ import org.apache.cxf.message.Message;
import org.apache.cxf.rt.security.SecurityConstants;
import org.apache.cxf.rt.security.claims.Claim;
import org.apache.cxf.rt.security.claims.ClaimCollection;
-import org.apache.cxf.rt.security.saml.claims.SAMLClaim;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.cxf.rt.security.utils.SecurityUtils;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
import org.opensaml.core.xml.XMLObject;
diff --git a/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/claims/SAMLClaimsTest.java b/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/claims/SAMLClaimsTest.java
index 66f14ac..cfd90f7 100644
--- a/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/claims/SAMLClaimsTest.java
+++ b/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/claims/SAMLClaimsTest.java
@@ -29,6 +29,7 @@ import org.w3c.dom.Document;
import org.apache.cxf.helpers.DOMUtils;
import org.apache.cxf.rt.security.claims.Claim;
import org.apache.cxf.rt.security.claims.ClaimCollection;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.cxf.rt.security.saml.utils.SAMLUtils;
import org.apache.wss4j.common.saml.SAMLCallback;
import org.apache.wss4j.common.saml.SAMLUtil;
diff --git a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java b/rt/security/src/main/java/org/apache/cxf/rt/security/claims/ClaimBean.java
similarity index 94%
rename from rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java
rename to rt/security/src/main/java/org/apache/cxf/rt/security/claims/ClaimBean.java
index 3216f7a..e3aa2d6 100644
--- a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/ClaimBean.java
+++ b/rt/security/src/main/java/org/apache/cxf/rt/security/claims/ClaimBean.java
@@ -16,9 +16,8 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.cxf.rt.security.saml.claims;
+package org.apache.cxf.rt.security.claims;
-import org.apache.cxf.rt.security.claims.Claim;
import org.apache.cxf.security.claims.authorization.ClaimMode;
public class ClaimBean {
diff --git a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/SAMLClaim.java b/rt/security/src/main/java/org/apache/cxf/rt/security/claims/SAMLClaim.java
similarity index 97%
rename from rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/SAMLClaim.java
rename to rt/security/src/main/java/org/apache/cxf/rt/security/claims/SAMLClaim.java
index 9d34ac8..7c4e545 100644
--- a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/claims/SAMLClaim.java
+++ b/rt/security/src/main/java/org/apache/cxf/rt/security/claims/SAMLClaim.java
@@ -17,10 +17,7 @@
* under the License.
*/
-package org.apache.cxf.rt.security.saml.claims;
-
-import org.apache.cxf.rt.security.claims.Claim;
-
+package org.apache.cxf.rt.security.claims;
/**
* This represents a Claim that is coupled to a SAML Assertion
diff --git a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java b/rt/security/src/main/java/org/apache/cxf/rt/security/claims/interceptor/ClaimsAuthorizingInterceptor.java
similarity index 95%
rename from rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java
rename to rt/security/src/main/java/org/apache/cxf/rt/security/claims/interceptor/ClaimsAuthorizingInterceptor.java
index c69992a..8f254be 100644
--- a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptor.java
+++ b/rt/security/src/main/java/org/apache/cxf/rt/security/claims/interceptor/ClaimsAuthorizingInterceptor.java
@@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.cxf.rt.security.saml.interceptor;
+package org.apache.cxf.rt.security.claims.interceptor;
import java.lang.reflect.Method;
import java.util.ArrayList;
@@ -36,9 +36,9 @@ import org.apache.cxf.interceptor.security.AccessDeniedException;
import org.apache.cxf.message.Message;
import org.apache.cxf.phase.AbstractPhaseInterceptor;
import org.apache.cxf.phase.Phase;
-import org.apache.cxf.rt.security.saml.claims.ClaimBean;
-import org.apache.cxf.rt.security.saml.claims.SAMLClaim;
-import org.apache.cxf.rt.security.saml.claims.SAMLSecurityContext;
+import org.apache.cxf.rt.security.claims.ClaimBean;
+import org.apache.cxf.rt.security.claims.ClaimsSecurityContext;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.cxf.security.SecurityContext;
import org.apache.cxf.security.claims.authorization.Claim;
import org.apache.cxf.security.claims.authorization.ClaimMode;
@@ -69,13 +69,13 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
public void handleMessage(Message message) throws Fault {
SecurityContext sc = message.get(SecurityContext.class);
- if (!(sc instanceof SAMLSecurityContext)) {
+ if (!(sc instanceof ClaimsSecurityContext)) {
throw new AccessDeniedException("Security Context is unavailable or unrecognized");
}
Method method = getTargetMethod(message);
- if (authorize((SAMLSecurityContext)sc, method)) {
+ if (authorize((ClaimsSecurityContext)sc, method)) {
return;
}
@@ -100,7 +100,7 @@ public class ClaimsAuthorizingInterceptor extends AbstractPhaseInterceptor<Messa
throw new AccessDeniedException("Method is not available : Unauthorized");
}
- protected boolean authorize(SAMLSecurityContext sc, Method method) {
+ protected boolean authorize(ClaimsSecurityContext sc, Method method) {
List<ClaimBean> list = claims.get(method.getName());
org.apache.cxf.rt.security.claims.ClaimCollection actualClaims = sc.getClaims();
diff --git a/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java b/rt/security/src/test/java/org/apache/cxf/rt/security/claims/interceptor/ClaimsAuthorizingInterceptorTest.java
similarity index 78%
rename from rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java
rename to rt/security/src/test/java/org/apache/cxf/rt/security/claims/interceptor/ClaimsAuthorizingInterceptorTest.java
index 5e6b14b..aadc168 100644
--- a/rt/security-saml/src/test/java/org/apache/cxf/rt/security/saml/interceptor/ClaimsAuthorizingInterceptorTest.java
+++ b/rt/security/src/test/java/org/apache/cxf/rt/security/claims/interceptor/ClaimsAuthorizingInterceptorTest.java
@@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.cxf.rt.security.saml.interceptor;
+package org.apache.cxf.rt.security.claims.interceptor;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
@@ -25,24 +25,26 @@ import java.lang.annotation.Target;
import java.security.Principal;
import java.util.Arrays;
import java.util.Collections;
+import java.util.HashSet;
import java.util.Set;
+import javax.security.auth.Subject;
+
+import org.apache.cxf.common.security.SimpleGroup;
import org.apache.cxf.common.security.SimplePrincipal;
import org.apache.cxf.interceptor.security.AccessDeniedException;
import org.apache.cxf.interceptor.security.SecureAnnotationsInterceptor;
import org.apache.cxf.message.ExchangeImpl;
import org.apache.cxf.message.Message;
import org.apache.cxf.message.MessageImpl;
+import org.apache.cxf.rt.security.claims.ClaimBean;
import org.apache.cxf.rt.security.claims.ClaimCollection;
-import org.apache.cxf.rt.security.saml.claims.ClaimBean;
-import org.apache.cxf.rt.security.saml.claims.SAMLClaim;
-import org.apache.cxf.rt.security.saml.claims.SAMLSecurityContext;
-import org.apache.cxf.rt.security.saml.utils.SAMLUtils;
+import org.apache.cxf.rt.security.claims.ClaimsSecurityContext;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.cxf.security.SecurityContext;
import org.apache.cxf.security.claims.authorization.Claim;
import org.apache.cxf.security.claims.authorization.ClaimMode;
import org.apache.cxf.security.claims.authorization.Claims;
-import org.apache.wss4j.common.saml.builder.SAML2Constants;
import org.junit.Assert;
import org.junit.Before;
@@ -182,8 +184,7 @@ public class ClaimsAuthorizingInterceptorTest extends Assert {
in.handleMessage(m);
ClaimsAuthorizingInterceptor in2 = new ClaimsAuthorizingInterceptor();
- org.apache.cxf.rt.security.saml.claims.SAMLClaim claim =
- new org.apache.cxf.rt.security.saml.claims.SAMLClaim();
+ SAMLClaim claim = new SAMLClaim();
claim.setNameFormat("a");
claim.setName("b");
claim.addValue("c");
@@ -217,10 +218,47 @@ public class ClaimsAuthorizingInterceptorTest extends Assert {
claims.addAll(Arrays.asList(claim));
Set<Principal> roles =
- SAMLUtils.parseRolesFromClaims(claims, SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT,
- SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
-
- SecurityContext sc = new SAMLSecurityContext(new SimplePrincipal("user"), roles, claims);
+ parseRolesFromClaims(claims, SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT,
+ "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified");
+
+ ClaimsSecurityContext sc = new ClaimsSecurityContext() {
+
+ private Principal p = new SimplePrincipal("user");
+
+ @Override
+ public Principal getUserPrincipal() {
+ return p;
+ }
+
+ @Override
+ public boolean isUserInRole(String role) {
+ if (roles == null) {
+ return false;
+ }
+ for (Principal principalRole : roles) {
+ if (principalRole != p && principalRole.getName().equals(role)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ @Override
+ public Subject getSubject() {
+ return null;
+ }
+
+ @Override
+ public Set<Principal> getUserRoles() {
+ return roles;
+ }
+
+ @Override
+ public ClaimCollection getClaims() {
+ return claims;
+ }
+
+ };
Message m = new MessageImpl();
m.setExchange(new ExchangeImpl());
m.put(SecurityContext.class, sc);
@@ -232,7 +270,7 @@ public class ClaimsAuthorizingInterceptorTest extends Assert {
private org.apache.cxf.rt.security.claims.Claim createDefaultClaim(
Object... values) {
return createClaim(SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT,
- SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED,
+ "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
values);
}
@@ -296,4 +334,35 @@ public class ClaimsAuthorizingInterceptorTest extends Assert {
public @interface SecureRole {
String[] value();
}
+
+ private static Set<Principal> parseRolesFromClaims(
+ ClaimCollection claims,
+ String name,
+ String nameFormat
+ ) {
+ String roleAttributeName = name;
+ if (roleAttributeName == null) {
+ roleAttributeName = SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT;
+ }
+
+ Set<Principal> roles = new HashSet<>();
+
+ for (org.apache.cxf.rt.security.claims.Claim claim : claims) {
+ if (claim instanceof SAMLClaim && ((SAMLClaim)claim).getName().equals(name)
+ && (nameFormat == null
+ || nameFormat.equals(((SAMLClaim)claim).getNameFormat()))) {
+ for (Object claimValue : claim.getValues()) {
+ if (claimValue instanceof String) {
+ roles.add(new SimpleGroup((String)claimValue));
+ }
+ }
+ if (claim.getValues().size() > 1) {
+ // Don't search for other attributes with the same name if > 1 claim value
+ break;
+ }
+ }
+ }
+
+ return roles;
+ }
}
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/common/SamlCallbackHandler.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/common/SamlCallbackHandler.java
index b8995df..ed8662a 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/common/SamlCallbackHandler.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/common/SamlCallbackHandler.java
@@ -31,7 +31,7 @@ import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.cxf.helpers.CastUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.phase.PhaseInterceptorChain;
-import org.apache.cxf.rt.security.saml.claims.SAMLClaim;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/saml/SamlCallbackHandler.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/saml/SamlCallbackHandler.java
index e8eff0a..72aea1a 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/saml/SamlCallbackHandler.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/saml/SamlCallbackHandler.java
@@ -35,7 +35,7 @@ import org.apache.cxf.phase.PhaseInterceptorChain;
import org.apache.cxf.rs.security.common.CryptoLoader;
import org.apache.cxf.rs.security.common.RSSecurityUtils;
import org.apache.cxf.rt.security.SecurityConstants;
-import org.apache.cxf.rt.security.saml.claims.SAMLClaim;
+import org.apache.cxf.rt.security.claims.SAMLClaim;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.saml.SAMLCallback;
import org.apache.wss4j.common.saml.bean.ActionBean;